@visa/cli 4.1.0-rc.143 → 4.1.0-rc.145

package/dist/checkout-engine/cli-engine.js

@@ -16,7 +16,7 @@ import { readFile } from 'node:fs/promises';
 import { launchCheckoutBrowser } from './browser-launch.js';
 import { prepareCheckout as realPrepareCheckout, submitApprovedCheckout as realSubmitApprovedCheckout, InMemoryPreparedCheckoutStore, } from './executor.js';
 import { claimMandatePickup as realClaimMandatePickup, runHostedApproval as realRunHostedApproval, } from './hosted-approval.js';
-import { VgsAssuranceInstrument, VgsLiveInstrument, decimalToMinor, minorToDecimal, } from './vgs-live-instrument.js';
+import { VgsLiveInstrument, decimalToMinor, minorToDecimal, } from './vgs-live-instrument.js';
 import { serverCreateIntent, serverFetchCryptogram, serverPostConfirmation, } from './vgs-gateway/server-mint-client.js';
 import { createCardMandate, DEFAULT_MANDATE_MAX_DRAWS, drawFromMandate, MandateDrawDeclinedError, } from './mandate/card-mandate.js';
 import { MandateLedger } from './mandate/mandate-ledger.js';
@@ -765,73 +765,31 @@ export function createCliCheckoutEngine(deps = {}) {
                     instrument = new VgsLiveInstrument(reference, session.contact.fullName ?? '', fetchCredential);
                 }
                 else {
-                    // A v4 card grant is aggregate authority, not a credential-only escape
-                    // hatch. Its spend must be represented by a claimed mandate so auth can
-                    // atomically reserve both the card scope and aggregate budget before a
-                    // payable cryptogram is minted. Falling through to the legacy 1:1 tap
-                    // here would create a real card credential with zero canonical draw.
-                    if (isV4CardGrant) {
-                        return {
-                            outcome: 'failed',
-                            confirmationRef: null,
-                            receiptPath: null,
-                            detail: 'this v4 card grant has no active mandate covering the purchase; run ' +
+                    // #7348 fresh-tap retirement: card spend is mandate-only for EVERY
+                    // runtime. The legacy 1:1 fresh-tap flow that lived here minted a
+                    // payable credential outside the grant/mandate ledger — invisible to
+                    // spending controls. The server now refuses non-budget approvals at
+                    // registration and non-budget mint tokens at verification; this
+                    // client refusal exists to give the honest remedy up front instead
+                    // of a mid-flow server error.
+                    return {
+                        outcome: 'failed',
+                        confirmationRef: null,
+                        receiptPath: null,
+                        detail: isV4CardGrant
+                            ? 'this v4 card grant has no active mandate covering the purchase; run ' +
                                 '`visa mandate start --ceiling <usd> --per-transaction <usd>` for the selected ' +
                                 'agent, approve and claim the mandate, then retry this checkout. No payment ' +
-                                'credential was requested and no charge was made.',
-                            vicConfirmation: null,
-                            source: null,
-                            remainingMinor: null,
-                        };
-                    }
-                    // --- Legacy 1:1 fresh-tap flow --------------------------------------
-                    // Kept only for a pre-v4 credential-file runtime. A selected v4 grant
-                    // can never reach this parallel, non-canonical accounting path.
-                    source = 'fresh-tap';
-                    // Legacy credential file only. A v4 grant was refused above unless a
-                    // covering mandate selected the canonical draw path.
-                    const credential = await resolveCardInstrument(input);
-                    const assurance = await runHostedApproval({
-                        baseUrl: input.approvalBaseUrl,
-                        tokenId: credential.tokenId,
-                        target: session.target,
-                        consumerEmail: session.contact.email,
-                        onApprovalUrl: input.onApprovalUrl ?? deps.onApprovalUrl,
-                    });
-                    // Server-side mint (Phase 1): the approval claim releases a scoped mint
-                    // token; the credential is minted by the verify-web deployment (which
-                    // holds the VGS secret), never on this machine. No token means the
-                    // deployment ran the dev-auth stub — refuse loudly rather than reach for
-                    // a client-held secret (there is none anymore).
-                    const mintToken = assurance.mintToken;
-                    if (!mintToken) {
-                        return {
-                            outcome: 'failed',
-                            confirmationRef: null,
-                            receiptPath: null,
-                            detail: 'the approval server issued no mint token — server-side minting requires the ' +
-                                'verify-web deployment to run real/turnkey auth (not the dev stub). Retry once it does.',
-                            vicConfirmation: null,
-                            source: 'fresh-tap',
-                            remainingMinor: null,
-                        };
-                    }
-                    confirmBase = input.approvalBaseUrl;
-                    confirmationAuthority = mintToken;
-                    instrument = new VgsAssuranceInstrument(credential, assurance, session.target, session.contact.fullName ?? '', async (mintInput) => {
-                        const { intentId, status } = await serverCreateIntent(confirmBase, mintToken, mintInput);
-                        try {
-                            const payment = await serverFetchCryptogram(confirmBase, mintToken, {
-                                tokenId: mintInput.tokenId,
-                                intentId,
-                                transaction: mintInput.transaction,
-                            });
-                            return { payment, intentId };
-                        }
-                        catch (err) {
-                            throw new Error(`${err.message} (intent status at creation: ${status ?? 'unknown'})`);
-                        }
-                    });
+                                'credential was requested and no charge was made.'
+                            : 'one-off card approvals are retired (#7348): card spending always runs through ' +
+                                'an owner-approved mandate now. Attach card authority to this agent ' +
+                                '(`visa agent grant-card <agent-id> --ceiling <usd> --per-transaction <usd> --wait`), ' +
+                                'then start and claim a mandate (`visa mandate start <usd> --per-transaction <usd>`), ' +
+                                'and retry the checkout. No payment credential was requested and no charge was made.',
+                        vicConfirmation: null,
+                        source: null,
+                        remainingMinor: null,
+                    };
                 }
                 const mode = input.submit ? 'submit' : 'dry-run';
                 const result = await submitApprovedCheckout(input.reviewId, {

package/dist/checkout-engine/vgs-gateway/server-mint-client.js

@@ -43,7 +43,18 @@ export function merchantOrigin(url) {
 /** Read a stable, non-secret error message from a route's JSON body. */
 async function routeError(res) {
     const doc = (await res.json().catch(() => null));
-    return doc?.error || doc?.error_code || `HTTP ${res.status}`;
+    const base = doc?.error || doc?.error_code || `HTTP ${res.status}`;
+    // Carry the provider's own status and rejected-attribute identifiers into the
+    // message when the route reflected them. Without this the operator sees only
+    // our status and has to go log-diving to learn WHICH field the gateway
+    // objected to — the gap that left a live create_intent 422 undiagnosable.
+    const parts = [];
+    if (typeof doc?.upstream_status === 'number')
+        parts.push(`upstream_status=${doc.upstream_status}`);
+    if (Array.isArray(doc?.upstream_codes) && doc.upstream_codes.length > 0) {
+        parts.push(`upstream_codes=${doc.upstream_codes.join(',')}`);
+    }
+    return parts.length > 0 ? `${base} [${parts.join(' ')}]` : base;
 }
 function bearer(mintToken) {
     return { 'content-type': 'application/json', authorization: `Bearer ${mintToken}` };
@@ -149,7 +160,11 @@ export async function serverFetchCryptogram(base, mintToken, input, deps = {}) {
             };
         }
         // A 4xx (bad request / binding refusal / auth) is terminal — never retry it.
-        if (res.status >= 400 && res.status < 500) {
+        // 429 is the sole exception: it is an explicitly retryable 4xx, and treating
+        // it as terminal would let a transient rate limit permanently disable a
+        // healthy mandate. The route maps upstream rate limits to 503 today, so this
+        // is a guard against a future emitter, not a live path.
+        if (res.status >= 400 && res.status < 500 && res.status !== 429) {
             throw new Error(`server cryptogram refused (${res.status}): ${await routeError(res)}`);
         }
         lastError = `${res.status}: ${await routeError(res)}`;